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(57)Abstract: 

PROBLEM TO BE SOLVED: To provide an illegal access 
detection system capable of detecting illegal accesses 
of various patterns including an unknown method. 
SOLUTION: The latest access policy of a site to be a 
management object is acquired from a management 
server 20 and held. Packets addressed to the site are 
acquired among packets circulated in a network, and 
packets suitable for the access policy and packets 
unsuitable for the access policy are sorted amount the 
acquired packets. When a packet unsuitable for the 
policy is selected, the packet is specified as a packet 
having possibility of being an illegal access and notified 
to the management server 20 in order to change an 
access condition for removing an access based on the 
specified packet. 
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«T^IEZ^-feX^a]5/X-7-A 1 OfrZCDT 

^, ^np>^»tt$g7 r -^^-x2 ifc««f-r*t4: 

t(c, **6KjSUTa&SV>t4S»Wf£:, 7^-trX^U5/ 
— l?^iE7^-trX^5/X-7 : -A 1 0 fciHflTfS t><DT 

7^-feXjHU5/-H*^M^n/-c®-&tctt, 
SnfcrtS^rSHflJ-r^o BE^ti, FTP (File Transfe 
r Protocol) 7*n F 3;H|IC iS7 T ;VeiM^*f U 

if^Mtio z^-bx#';5>-^%@B^-rs^^ = 
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[0 0 2 8] >fI^^a-;V2 2 ^lET 

^■txmii-yxfA i o^e>^iET^-feX(D^tt*^ 
mm&m 'Pttmzi&zv'f h^z^txM (7* 

X*#kLT«, GflS.Hu 77-i'7-')^-;KDl8SI 
[0 0 2 9] J;Om<*Wtctis ^IE7^-bX^->Xx 
IF) t^7^'>3^ttf-^^-XDB 2 3fcfi!#L 

£:7^ •> if fo^ > * ^ x -xfr e. ^st ; £ 3 <t ^ tc-r 
5, ms.s*iftmt. mmvmmzgk (yuh^Mtm 

©) k&3?FIE7^-feXI;:o^Tli, *<DgH&©7* 
0*>5coil^^|Rl«i:^:57^-bXlcov^ti, fc 

[0 0 3 0] <T^-feX©fflSiJ«^73{*>^^. ±15© 
^FIETi'-bX^i/X-rA 1 0RtfSlU--^2 0*ffl 

^T7y -t xoag'jfcw^-r ^ ?3 & (Dnmnrnzm w-t 

1 0^0 1 ©*>y F7 — ^X-rAfcfcttS^'y F© 

jq->xfL i o tcfeit afflatus (±JW»ai5c on io 

5—09 (i^ttWftrtSKWBlTfeSo 
[0 0 3 1] £f\ *^SgJ^ftltC*5V^T^iET^-feX<D 
^Mfetf&^k LT^^nST **X©1«&*BI 5 © 

L46Tt^&i^rtg|$*X hM K SMTPZ^-feX©*^^ 
t5^-M-/<M2, URL^MLTi/^WWW-tt-AM 

3 ^tn^nmmM^^ Fk-ra«^©0<n?&So c 

?n5. ^M2Aff)7 7-feXL 2fCOl^T 

ti, lE^SMTPZ^-trxti^fti^n^v^^ SMTP7*-fe 
XJJlfl.* I^LTV^l^SMTPavi/FCcfc^^-feX, 



/SM3©T^-feXL 3fcOV>T«:, LTI/^URLIC 
^SIE^WWWT^-feXti^^n^l/^^ *n&9\-<D 

[0 0 3 2] B4*#RBU ±IB©J:5£:7^-bX©ffl 
BU*^?* 3 ^FIE7^-trX^&h>X 

ta i oti> ss^-^2 o^6sasw«ifc**iJ--i' h 

©7 * -b X* 'J iv-&tfr p h 3 /H±«©-r- £ 2*7 
>a-FLTf*^fLTfc< (Xf--y7S 1 0 1 ) 0 BEtc 

[0 0 3 3] 06©±I3«. Ta.b.c.dJ k^-3 rffifc 
7FUXJ Zn-oit^ hlcM?Z'<>'?-Z--y b a±<D 

r-T^TJ © P&iETzT FbXJ #lfOi»fr£© Hit 
tp/tcpj hn;M±«fcJ;S7 7 7-tXlcov^T{±. 
Ctl^iE'^T'^'-bXi: LTiftd^f? C t^SWLTt/^ 
& c Rl«fz:, Ta.b.c.eJ t^o r»Jfe7KUXj 

o^*fc*trs-i'>*— *y Fa±© r-r^Tj © 

lircZFU-Xj ^^ffi*^?.© Tsmtp/tcpj T'n h 
3 ;W±«ltc ck 5 7 * -t x t, lE^'T ^ -b x fc L TiS ton 

§„ fifHAtfWfW (HTTP) OJi^-Ji, raK^f i FoJf^f ; -< 

cn5<D7n hayl/fc^tUcm-rsiBffifllBtt. ^46 
gg-y— /^2 oteB8LT:fe<<$B*M&So Heo^ijt 5 

ti, WWW-y— ex (7a h3;l/*WTPO»&) T*«, 

d k^T^. ■;!/- FtV h U ©TO I"/ 
Index, htmlj 7 7^K T/whatsnew/* J „ r/pro 
ducts/* J , r/ pro file/*J (* tittfftO^^J^r 
^■To ) ©ri 1 1/^ h 'JETOt^T<077'C;l' / \O7 
^-bX^ifRlf 3Ci:£:^LTV^ 0 ^Offis T7a F 
3;MWfO*ftJ T-tts ttrtT rffiffl*TS>«-;l/7KU 
Xj Jfffiffl* riW^nvyKj f^Jti-Sct 

[0 0 3 4] mA\zmK>, 77tX#'Ji/-f«:^> 
D-FLfc^IE7^-feX^^X7 L A 1 Ott, 

-7^xfA±%»%'^7 hfcfinsiaau wa 
*t«ik^s-y^ hjao/^v h*^ofe*&t±tn%«i 

a-r^ (X-r-y7S 1 0 2) o Ctitt, 

h <d^ >y ¥mwm*mm- %>nt^&-oT'<7o a 

HLfc^7 7 FlC^LT. 7Dh3;l/ttSfl7 

^&tf7^-feX^y->-^x-y^«:?T3 Ufy7S 1 
0 3) o 

[0 0 3 5] 0 7li, 7nh3;H±ifx-V7©«^€i 
— W**Lfc0t?a6So 7*nb3;l/ttIfx7 7B, 7 
a ha;l/ttif-^^-XDB 1 1 Jc^^tlTVS IP 
'Ny^ F^>X^-h/i-N-y^> 77'yy— >3Vi 
k J: 5 tc7a h S5(tt^:^5 c kT-f? 
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5„ M7lcl±. KUP^a haM±m<D^<Dmif^tl 
TV>« 0 HTTP:/D h3;M±«OfefcT?tt, IP^y^ TC 
PNy^ HTTP^-y^ HTTPx— *©MBfC*-x >y *Sft 

-f-;l/KO'(B^iELv>igHtilK*oTV^^i:'55b\ IP 
"N -y #'© IP^y-y h ^faft 7 -f — )]/ F ©fit IP'S >y £*:B 
!7^-;l/F©ffik::?Jitf&V>frH5;b"> (IP/^-y 

TCP^#'&IP^^£|EU1t©rt^<t;&£o ^©f&. HTT 
P-n >y £»&:7 -f — F©7 V «y h #{±1381 t> £fE 

a>$nrv^©T\ cn&f&K^sc m 

fiS^snscfctc^oTv^c nrnat "ge 
r ix^tct "posr mtf&&t>\ ccTBtets. 

GET "Request - URL" HTTP/1.1 (/S— 5? a >1.1©±§ 

GET "Request - URL" HTTP/ 1 . 0 (/S— 5? a >1.0©Jf 
□ J 

GET "Request - URL" 

£©£:^ "Request - URL" i:^?/*^ — £fc{4, -9" 
-/V\g;J<-r£URL^A£n3o C©SBTtt, C© 

©»5WM±« ^ T ^ S £ 5 * ^ x *y * "T -5 c ft 
ilCfe^n^V^ ( "HTTP/1.0" "HTTP/1.1" 

- ^x©M^i4#&5£:«£-rSo 

[0 0 3 6] —7a. 7^-bX^'J->-fx7^m ^ 
>y -y h tfj© F UX/SJUItcT F UX/SJffl 7n 

hn/l/ (=TCP&.t/UDP©#- h©##) J ©F*9#£\ 7 
^-trX#"J y-f-^^-XDB 1 2 tcgii^tiT^ 
^Mt)"-r hT*fFWfr-57^-trX^U'>-©rt^i:]t 

ST5o 5ttiif©tt^©^x -y *T?ttfrfe**^;fc ,, Req 
uest-URL"©F*9^©^x -y ^fi. CI CI T-7^-feX#l> ~> 
-^x>y^fcLTtf do 7a hn;Wfifi-^ 

^^-feX/K'J v--^x >y *T-t±, ^LT'k^-g^fe 

[0 0 3 7] K±Ogfi7^©m ISL6l/V^ 
Uf7 7'S 1 0 4 : No) o — JlKf 5^-y h 



^FIE7^-bX©^1S*^5i:*iJJg-rs (Xf7 7"S 1 
0 4 : Yes) „ d©^x-y^£H4, 0^L&l/^»- 
*/l/SS**fc:. ^x-y^fflJSi:LTIS^LTfc<„ c 
©^-x-y^fflE©— i?;SLfc0^9Tfe5 0 0 9 

(a) H\ 7*Dh3;l/ft^i770iS, Is) (b) 
(4, 7 ? -b X# U x >y * ©*£m©JIET*fc 2>«, 

[0 0 3 8] i&KUfc/^'y hTfc-pfcii^fi. 
^■y hfcH-rSIWR G£«tc7FUX§§0 *«fSr*4: 
ttt (Xf77"S 10 5), 

-XDB 1 3 ^#SLT> iffiftl^g»tfffi5Brt'g*1#3£ 
L (Xf77'S 10 6), jUOfllS!*^'*-* (Xf7 
7*S107). 

[0 0 3 9] T7-L.m$Q9c'r-5iT-7>D B 1 3 fc 

rasnftj is^-rs ra*nrt^j x^jETt-t 

2 2tC<fcoT, «f(D7^->a ^^rZ^v'a v^ftf*— 

[0 0 4 0] c©<£5£> *^*SJB!B«07tr&»!:«tntf, 
3K*«f"JjS^feSo Sfc, fiE3fc© J: o \z.mfr®ffi&?k 

mm lt^fiet ^-bxA^H 3 A^jpj^-r 5 totaft^ 
©t\ ^©aspA^^tc^^ns ctfe4<, ;ss»e 

SHI* >y h feaittk:«*S-r 5 c f: ^Tt 
T 5 -tr 7. ©M^tt© U 7 )\> Z -Y A t?|JMffl L X </> 5 

r> * - /Ko^it «fc 5 mm ic & § fu j& t 

[0 0 4 1 ] **S6JK«IT'{4, iligWlctitonT 
^av^ 7*o h n/i/fti^? i"bX/1? ij 
±jZE©7 p p S/— «f>, l|i{itB#P^$.fcO©7'^-fe 

X©laI^* ,t 7'^-bX^'J->-fcfSxE^nTV^7 7 ^-bX 

[0 0 4 2] 

[5§^©^J*] W±<DKW^6W6*^«t5fc» *f8B^ 
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MttmtZo 1 3 

mm<DmmrMm 1 4 

[0 1 ] #f§fW*SSffl£n3*-y h7-^X7-2*<D± 1 5 

foMf&m* 1 6 

[0 2] ^lET^-trX^^X-rA^^glg^iao 2 0 

[03] wmv-^<DmmMf&mo 2.1 

[0 4] ^jE7^X^&^XxAcD#)lMS0 o 2 2 

[0 5] *^mi^fc^TjlSi:^n§7'^-bXcDlffi DB 1 1 

^7jkLfcm a D B 1 2 

[06] 7^tX^'J h3M±WI^ D B 1 3 

L/ca D B 2 1 

[0 7] 7n h 3;l/ttifi 7 ^©te^L/cio DB2 2 

[08] T^-AjIftft^'-^-XOrt^J^Lfc D B 2 3 

0 0 I N T 1 
[0 9] (a) Itfu haMtUl^x-y ?<D%§3k, C0N1 
(b) «7^tX-K'J->-fx7^(D»-i^L 3 0 

fc0 o T 1 

1 0 ^lET^-feXtf&Qv'XT-A 0 
1 1 T^-bX^U>'-fXf# ; &> i 'i-;l' y 



^•y ha»J*S^a-;I/ 

7 £ -tr X # U — r — * ^ - X 

7 7 - L.m%l9c : r- 2 X 

*•> h7-^WIf|g7 : -^^-X 

SSfflflB-r-*'*-* 

7 ? i/ 3 yZkft'r— 2 X 
, I NT 2 ^7h7-i'^y?7i-X 
, CON 2 3yfiiJ«5 

^FIE7^-bX%fS^ 

ISDN/'JtilSffl 



[01] 



[02] 




10 



11 



12 



13 



14 



WT1 



16 



CON! 



dbii 



12 



DB13 



75-A 
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[03] 



[0 4] 



20 



J 1 L 



TZ 



21 



CON2 



DB21 



B22 



DB23 



No 



start 



*5T^>d^K (fiH»/E*r) 



101 



102 



103 





Yes 





S104 



SI 05 



106 



107 



end 



[06] 





[0 5] 




2S(Stc 




-fa 








lEJftfrSMTP 


lEfcfrWWW 




a.b.c.d 


http/tcp 


ANY 


/indexhtml 
/whatsnew/ * 
/profile/ ♦ 


k 1 


k 2 


k 3 




a.d.c.e 


smtp/tcp 


ANY 


««0a co. jp 
#****0a co. jp 

VRFY„EXPN 




WWW 



17] 





TCP -x * ^ 


HTTP's**' 


HTTPf^-* 
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[0 8] 













postmaster @ a.co.jp 


^IE7 , ^<r^if<»^L* Lit 

rtfr/n-At. . O/fc . -j* n k -i jL ■ 
. W7t • ^ *j r J *v . 


o 




03- 1234-5678 




X 


TfJ-h 




*0E:r$fc**f§a*fcLS Lfc 


o 















[0 9] 



(a) 









I p 


IP^**^ 


lEfc 


IP£*S 


iEm 




IE» 


TCP 


TCP^-^g 


IE*? 


HTTP 
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(b) 








IP 




IE^ 




jES 


TCP 




jE» 




IE?* 


HTTP 




as 



(72)«w# mm 

(72)%B£# «5Ba ^ 

acft»ffi*K«ifH=TB3#3^ 



F£ — M##) 5B089 GA11 GA21 GB02 HA03 IIA06 
HA10 JA22 JA31 JB22 KA17 
KB04 KB06 KB13 

5K030 GA15 HB16 HB18 HC01 KA04 
KA13 LA08 LB02 LD19 LD20 

9A001 CC06 J J 14 JJ25 LL03 



